On May 25, 2011, the Securities and Exchange Commission (SEC) adopted final rules implementing the whistleblower incentives and protection requirements set forth in the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank). The new rules require the SEC to compensate eligible whistleblowers in connection with certain enforcement actions involving monetary sanctions of $1 million or more. The size of potential bounty payments under the rules may range from 10 percent to 30 percent of the monetary sanctions collected by the SEC. The new rules also implement Dodd-Frank's prohibitions on employer retaliation against whistleblowers who reasonably believe that the information they provide to the SEC relates to a possible securities violation. The new rules will become effective August 12, 2011.

Definition of a Whistleblower

The final rules define a whistleblower as a natural person (i.e. not a company or other entity) who, alone or jointly with others, provides information to the SEC relating to a "possible violation of the securities laws (including any rules or regulations thereunder) that has occurred, is ongoing or is about to occur." The SEC stated that the possible violation need not be "material, probable or even likely," and that all that is required is that the information provided by the whistleblower must have a "facially plausible relationship to some securities law violation."

Information Requirements

Awards are to be paid to eligible whistleblowers who voluntarily provide the SEC with original information that leads to a successful enforcement action yielding monetary sanctions of at least $1 million.  

  • "Voluntarily" providing information: In general, a whistleblower is deemed to have provided information voluntarily if the whistleblower provided information before receiving any request, inquiry or demand relating to the matter from the SEC or another governmental or regulatory authority.
  • "Original information": Original information includes information (i) based upon the whistleblower's "independent knowledge" or "independent analysis," (ii) not already known to the SEC and (iii) not derived from an allegation made in a judicial or administrative hearing, government report, audit or investigation, or from the news media.
  • "Independent knowledge" and "independent analysis": The final rules define "independent knowledge" as factual information not derived from publicly available sources and "independent analysis" as the whistleblower's own analysis "done alone or in combination with others," which may be based on publicly available information. Information obtained illegally or through attorney-client privileged communications is not deemed to have been derived from an individual's independent knowledge or independent analysis. In addition, information obtained by an entity's attorneys, outside accountants, internal audit and compliance personnel, and persons retained to assist in investigations into alleged misconduct, as well as certain information received by an entity's directors, officers and other senior officials generally will not be considered to have been derived from such person's independent knowledge or independent analysis. However, the rules establish three exceptions to these exclusions:
    • the person reasonably believes disclosure of the information to the SEC is necessary to prevent the entity from causing substantial injury to the financial interest or property of the entity or investors;
    • the person reasonably believes that the entity is impeding an investigation of the misconduct; or
    • 120 or more days have elapsed since the person either provided the information to the audit committee, chief legal officer or chief compliance officer or received it under circumstances indicating that one of those individuals or the audit committee was aware of the information.  
  • Information leading to a successful enforcement by the SEC of a federal court or administrative action in which the SEC obtains monetary sanctions totaling more than $1 million:The whistleblower's information can be deemed to have led to a successful enforcement action if:
    • the information is sufficiently specific, credible and timely to cause the SEC to open a new examination or investigation, reopen a closed investigation or open a new line of inquiry in an existing examination or investigation;
    • the conduct was already under investigation when the information was submitted, and the information significantly contributed to the success of the action; or
    • the whistleblower reports "original information" through his or her employer's internal whistleblower, legal or compliance procedures; the whistleblower reports the information to the SEC within 120 days of the internal disclosure; the employer subsequently provides the whistleblower's information (and any subsequently discovered information) to the SEC; and the employer's report satisfies the two preceding bullets.

Use of Internal Compliance Program

Commenters on the proposed rules noted that the bounty program establishes substantial incentives to bypass internal compliance reporting mechanisms, which may inhibit internal efforts to investigate and remediate potential compliance violations. The SEC did not, as many commenters suggested, include a requirement that whistleblowers report violations internally as a prerequisite for eligibility under the bounty program. The SEC has, however, sought to balance the desire to avoid negative effects on internal compliance programs and the desire to establish incentives for whistleblowers to provide information to the SEC through the following provisions in the final rules:

  • The final rules provide that when the SEC is determining the amount of an award, the whistleblower's voluntary participation in an entity's internal compliance and reporting systems will be a factor that can increase the amount of an award. Also, a whistleblower's interference with internal compliance and reporting will be a factor that can decrease the amount of an award.
  • In addition, employees who first report information internally will be considered to have provided information to the SEC as of the internal reporting date for purposes of the bounty program so long as the whistleblower submits the same information to the SEC within 120 days of the initial internal disclosure.
  • A whistleblower will receive credit for information reported internally if the company then reports the information to the SEC, even if the whistleblower's original information would not have met all of the criteria for eligibility under the bounty program